coretrace-python-analyzer 0.2.0__py3-none-any.whl → 0.4.0__py3-none-any.whl

coretrace_python/__init__.py

@@ -1,4 +1,4 @@
 """CoreTrace's Python static analysis frontend."""
 
-__version__ = "0.2.0"
+__version__ = "0.4.0"
 

coretrace_python/bundled/dependency/reachable_vulnerability/reachable_vulnerability.py

@@ -7,6 +7,7 @@ from typing import ClassVar
 
 from coretrace_python.analysis import AnyAnalysis
 from coretrace_python.dependency import DependencyAnalysis
+from coretrace_python.dependency.correlation import affected_symbols, evidence
 from coretrace_python.findings import Confidence, Finding
 from coretrace_python.interprocedural import CallGraphAnalysis, ExternalSymbol
 from coretrace_python.plugins import ProjectContext, ProjectPlugin
@@ -17,12 +18,7 @@ class ReachableVulnerabilityPlugin(ProjectPlugin):
     requires: ClassVar[frozenset[AnyAnalysis]] = frozenset({DependencyAnalysis, CallGraphAnalysis})
 
     def analyze_project(self, ctx: ProjectContext) -> Sequence[Finding]:
-        affected = {}
-        for requirement in ctx.dependencies.requirements:
-            for advisory in ctx.advisories:
-                if advisory.affects(requirement):
-                    for symbol in advisory.affected_symbols:
-                        affected.setdefault(symbol, advisory)
+        affected = affected_symbols(ctx.dependencies, ctx.advisories)
         if not affected:
             return ()
         findings: list[Finding] = []
@@ -32,25 +28,19 @@ class ReachableVulnerabilityPlugin(ProjectPlugin):
                 for site in graph.sites(function):
                     if not isinstance(site.target, ExternalSymbol):
                         continue
-                    advisory = affected.get(site.target.symbol)
-                    if advisory is None:
-                        continue
-                    findings.append(
-                        Finding(
-                            rule_id="reachable-vulnerability",
-                            message=(
-                                f"{advisory.id}: {site.target.symbol} is affected in the required "
-                                f"{advisory.package} {advisory.vulnerable}: {advisory.summary}"
-                            ),
-                            severity=advisory.severity,
-                            confidence=Confidence.HIGH,
-                            span=site.location,
-                            function=function,
-                            metadata={
-                                "advisory": advisory.id,
-                                "package": advisory.package,
-                                "symbol": str(site.target.symbol),
-                            },
+                    for advisory in affected.get(site.target.symbol, ()):
+                        findings.append(
+                            Finding(
+                                rule_id="reachable-vulnerability",
+                                message=(
+                                    f"{advisory.id}: {site.target.symbol} is affected in the required "
+                                    f"{advisory.package} {advisory.vulnerable}: {advisory.summary}"
+                                ),
+                                severity=advisory.severity,
+                                confidence=Confidence.HIGH,
+                                span=site.location,
+                                function=function,
+                                metadata=evidence(advisory, site.target.symbol, "reachable"),
+                            )
                         )
-                    )
         return findings

coretrace_python/bundled/dependency/sample_advisories/sample_advisories.py

@@ -28,6 +28,7 @@ class SampleAdvisories(ModelPlugin):
             "yaml.load and full_load can execute arbitrary code from untrusted documents",
             Severity.CRITICAL,
             (_sym("yaml.load"), _sym("yaml.full_load"), _sym("yaml.unsafe_load")),
+            modules=("yaml",),
         ),
         Advisory(
             "CVE-2018-18074",
@@ -105,5 +106,6 @@ class SampleAdvisories(ModelPlugin):
             Severity.HIGH,
             (_sym("PIL.Image.open"),),
             ("GHSA-cfh3-3jmp-rvhc",),
+            modules=("PIL",),
         ),
     )

coretrace_python/bundled/dependency/vulnerable_dependency/vulnerable_dependency.py

@@ -17,11 +17,13 @@ class VulnerableDependencyPlugin(ProjectPlugin):
 
     def analyze_project(self, ctx: ProjectContext) -> Sequence[Finding]:
         findings: list[Finding] = []
+        imported = [s for module in ctx.modules for s in ctx.imports(module).all_symbols()]
         for requirement in ctx.dependencies.requirements:
             for advisory in ctx.advisories:
                 if not advisory.affects(requirement):
                     continue
                 pinned = requirement.pinned is not None
+                level = "imported" if advisory.imported_by(imported) else "declared"
                 findings.append(
                     Finding(
                         rule_id="vulnerable-dependency",
@@ -37,6 +39,7 @@ class VulnerableDependencyPlugin(ProjectPlugin):
                             "advisory": advisory.id,
                             "package": advisory.package,
                             "specifier": requirement.specifier,
+                            "level": level,
                         },
                     )
                 )

coretrace_python/cache.py

@@ -14,7 +14,7 @@ from __future__ import annotations
 import hashlib
 import json
 import os
-from collections.abc import Iterable, Mapping
+from collections.abc import Mapping
 from dataclasses import dataclass
 from pathlib import Path
 from types import MappingProxyType
@@ -37,7 +37,7 @@ from coretrace_python.interprocedural import (
 from coretrace_python.semantic.symbols import SymbolId
 from coretrace_python.source import SourceId, SourceSpan
 
-CACHE_FORMAT = 4
+CACHE_FORMAT = 5
 
 
 @dataclass(frozen=True)
@@ -64,15 +64,18 @@ def fingerprint(*parts: str) -> str:
     return digest.hexdigest()
 
 
-def directory_fingerprint(directory: Path, suffixes: Iterable[str] = (".py", ".toml")) -> str:
-    """A digest of the source files under ``directory``, so edited plugin code misses."""
+def directory_fingerprint(directory: Path) -> str:
+    """A digest of every file under ``directory``, so an edited plugin misses: its code,
+    its manifest and the rule or advisory data it ships in any format. Bytecode and
+    hidden files are not part of what the plugin does."""
 
-    wanted = tuple(suffixes)
     parts: list[str] = []
     for path in sorted(directory.rglob("*")):
-        if path.is_file() and path.suffix in wanted:
-            parts.append(str(path.relative_to(directory)))
-            parts.append(path.read_text(encoding="utf-8", errors="replace"))
+        relative = path.relative_to(directory)
+        if not path.is_file() or any(p == "__pycache__" or p.startswith(".") for p in relative.parts):
+            continue
+        parts.append(str(relative))
+        parts.append(path.read_bytes().hex())
     return fingerprint(*parts)
 
 

coretrace_python/dependency/__init__.py

@@ -11,6 +11,8 @@ from coretrace_python.dependency.advisories import (
 from coretrace_python.dependency.graph import (
     DEPENDENCY_FILES,
     Advisory,
+    AdvisoryEntryPoint,
+    Condition,
     DependencyAnalysis,
     DependencyGraph,
     Requirement,
@@ -26,7 +28,9 @@ __all__ = [
     "DEPENDENCY_FILES",
     "POLICY_FILE",
     "Advisory",
+    "AdvisoryEntryPoint",
     "AdvisoryFileError",
+    "Condition",
     "DependencyAnalysis",
     "DependencyGraph",
     "Policy",

coretrace_python/dependency/advisories.py

@@ -5,8 +5,8 @@ OSV dump into ``Advisory`` values, keeping the PyPI ecosystem and turning each r
 events into a version specifier; ``dump_advisories`` writes them as a small JSON file
 that a project keeps at its root as ``advisories.json`` or passes with ``--advisories``.
 OSV records name no affected APIs, so imported advisories feed the requirement checks
-and the SBOM; a file completed by hand with ``affected_symbols`` also feeds the
-reachability and correlation checks.
+and the SBOM; a file completed by hand with ``affected_symbols``, ``entry_points`` and
+their ``conditions`` also feeds the reachability and correlation checks.
 """
 
 from __future__ import annotations
@@ -17,7 +17,7 @@ from collections.abc import Iterable, Iterator, Mapping
 from pathlib import Path
 from typing import Any
 
-from coretrace_python.dependency.graph import Advisory, normalize
+from coretrace_python.dependency.graph import Advisory, AdvisoryEntryPoint, Condition, normalize
 from coretrace_python.findings import Severity
 from coretrace_python.semantic.symbols import SymbolId
 
@@ -84,8 +84,9 @@ def import_osv(records: Iterable[Mapping[str, Any]]) -> tuple[Advisory, ...]:
             if str(package.get("ecosystem", "")).lower() != "pypi" or not package.get("name"):
                 continue
             name = normalize(str(package["name"]))
-            for specifier in _specifiers(affected.get("ranges") or []):
-                advisories.append(Advisory(identifier, name, specifier, summary, severity, (), aliases))
+            specifiers = _specifiers(affected.get("ranges") or [])
+            if specifiers:
+                advisories.append(Advisory(identifier, name, " || ".join(specifiers), summary, severity, (), aliases))
     return tuple(advisories)
 
 
@@ -137,6 +138,15 @@ def dump_advisories(advisories: Iterable[Advisory]) -> str:
                 "severity": a.severity.value,
                 "affected_symbols": [str(s) for s in a.affected_symbols],
                 "aliases": list(a.aliases),
+                "entry_points": [
+                    {
+                        "symbol": str(e.symbol),
+                        "justification": e.justification,
+                        "conditions": [_condition_entry(c) for c in e.conditions],
+                    }
+                    for e in a.entry_points
+                ],
+                "modules": list(a.modules),
             }
             for a in advisories
         ],
@@ -144,6 +154,15 @@ def dump_advisories(advisories: Iterable[Advisory]) -> str:
     return json.dumps(document, indent=2) + "\n"
 
 
+def _condition_entry(condition: Condition) -> dict[str, Any]:
+    entry: dict[str, Any] = {"kind": condition.kind, "text": condition.text}
+    if condition.argument is not None:
+        entry["argument"] = condition.argument
+    if condition.values:
+        entry["values"] = list(condition.values)
+    return entry
+
+
 def load_advisories(path: Path) -> tuple[Advisory, ...]:
     try:
         document = json.loads(path.read_text(encoding="utf-8"))
@@ -165,4 +184,22 @@ def _advisory(entry: Mapping[str, Any]) -> Advisory:
         Severity(entry["severity"]),
         tuple(SymbolId(str(s)) for s in entry.get("affected_symbols") or []),
         tuple(str(a) for a in entry.get("aliases") or []),
+        tuple(_entry_point(e) for e in entry.get("entry_points") or []),
+        tuple(str(m) for m in entry.get("modules") or []),
+    )
+
+
+def _entry_point(entry: Mapping[str, Any]) -> AdvisoryEntryPoint:
+    return AdvisoryEntryPoint(
+        SymbolId(str(entry["symbol"])),
+        str(entry["justification"]),
+        tuple(
+            Condition(
+                str(c["kind"]),
+                str(c["text"]),
+                None if c.get("argument") is None else str(c["argument"]),
+                tuple(str(v) for v in c.get("values") or []),
+            )
+            for c in entry.get("conditions") or []
+        ),
     )

coretrace_python/dependency/correlation.py

@@ -11,77 +11,103 @@ from __future__ import annotations
 
 from collections.abc import Iterable, Mapping
 
-from coretrace_python.dependency.graph import Advisory, DependencyGraph
+from coretrace_python.dependency.graph import DIRECT, Advisory, DependencyGraph
 from coretrace_python.findings import Confidence, Finding, Severity
-from coretrace_python.findings.refutation import Status, Verdicts
+from coretrace_python.findings.refutation import Status, Verdict, Verdicts
 from coretrace_python.semantic.symbols import SymbolId
 from coretrace_python.taint import Sink, TaintFlow, TaintKind
 
+Affected = Mapping[SymbolId, tuple[Advisory, ...]]
 
-def affected_symbols(
-    dependencies: DependencyGraph, advisories: Iterable[Advisory]
-) -> Mapping[SymbolId, Advisory]:
-    """The APIs affected by advisories whose package is required in a vulnerable version."""
 
-    affected: dict[SymbolId, Advisory] = {}
+def affected_symbols(dependencies: DependencyGraph, advisories: Iterable[Advisory]) -> Affected:
+    """The APIs affected by advisories whose package is required in a vulnerable version,
+    each with every such advisory: a call to ``yaml.load`` reaches every CVE of the
+    pinned release, not the first one listed."""
+
+    affected: dict[SymbolId, list[Advisory]] = {}
     for requirement in dependencies.requirements:
         for advisory in advisories:
             if advisory.affects(requirement):
-                for symbol in advisory.affected_symbols:
-                    affected.setdefault(symbol, advisory)
-    return affected
+                for symbol in advisory.reachable_symbols:
+                    found = affected.setdefault(symbol, [])
+                    if advisory not in found:
+                        found.append(advisory)
+    return {symbol: tuple(found) for symbol, found in affected.items()}
 
 
-def advisory_sinks(affected: Mapping[SymbolId, Advisory]) -> tuple[Sink, ...]:
+def advisory_sinks(affected: Affected) -> tuple[Sink, ...]:
     return tuple(Sink(symbol, TaintKind.ADVISORY) for symbol in affected)
 
 
+def evidence(advisory: Advisory, symbol: SymbolId, level: str) -> dict[str, str]:
+    """What a finding keeps of the advisory for ``symbol``: the level of evidence
+    established, how the symbol relates to the vulnerability and under which
+    conditions, the ones the engine could not check listed as pending review."""
+
+    metadata = {"advisory": advisory.id, "package": advisory.package, "symbol": str(symbol), "level": level}
+    entry = advisory.entry_point(symbol)
+    if entry is None:
+        metadata["justification"] = DIRECT
+        return metadata
+    metadata["entry_point"] = str(entry.symbol)
+    metadata["justification"] = entry.justification
+    if entry.conditions:
+        metadata["conditions"] = "; ".join(c.text for c in entry.conditions)
+        # ponytail: no condition is checked yet, so every one awaits review; argument
+        # conditions get checked at the call site once call sites carry argument symbols.
+        metadata["conditions_pending_review"] = "; ".join(c.text for c in entry.conditions)
+    return metadata
+
+
 def correlate(
     function: str,
     flows: Iterable[TaintFlow],
     verdicts: Verdicts | None,
-    affected: Mapping[SymbolId, Advisory],
+    affected: Affected,
 ) -> tuple[Finding, ...]:
-    """Exploitable-vulnerability findings for the non-refuted ADVISORY flows of a function."""
+    """Exploitable-vulnerability findings for the non-refuted ADVISORY flows of a function,
+    one per advisory the sink is affected by."""
 
     findings: list[Finding] = []
     for flow in flows:
         if not flow.kinds & TaintKind.ADVISORY:
             continue
-        advisory = affected.get(flow.sink.symbol)
-        if advisory is None:
-            continue
         verdict = verdicts.verdict(flow) if verdicts is not None else None
         if verdict is not None and verdict.status is Status.REFUTED:
             continue
         hotspot = verdict is not None and verdict.status is Status.HOTSPOT
-        message = (
-            f"{advisory.id}: {flow.source.label} input reaches {flow.sink.symbol}, affected in "
-            f"the required {advisory.package} {advisory.vulnerable}: {advisory.summary}"
-        )
-        metadata = {
-            "advisory": advisory.id,
-            "package": advisory.package,
-            "symbol": str(flow.sink.symbol),
-            "source": str(flow.source.symbol),
-            "source_label": flow.source.label,
-            "verdict": "hotspot" if hotspot else "vulnerability",
-        }
-        if verdict is not None:
-            metadata["evidence"] = verdict.evidence
-        if flow.through is not None and flow.sink_location is not None:
-            message += f" through {flow.through}"
-            metadata["through"] = flow.through
-            metadata["sink_line"] = str(flow.sink_location.start_line)
-        findings.append(
-            Finding(
-                rule_id="exploitable-vulnerability",
-                message=message,
-                severity=Severity.CRITICAL,
-                confidence=Confidence.MEDIUM if hotspot else Confidence.HIGH,
-                span=flow.location,
-                function=function,
-                metadata=metadata,
-            )
+        findings.extend(
+            _exploitable(function, flow, advisory, verdict, hotspot) for advisory in affected.get(flow.sink.symbol, ())
         )
     return tuple(findings)
+
+
+def _exploitable(
+    function: str, flow: TaintFlow, advisory: Advisory, verdict: Verdict | None, hotspot: bool
+) -> Finding:
+    message = (
+        f"{advisory.id}: {flow.source.label} input reaches {flow.sink.symbol}, affected in "
+        f"the required {advisory.package} {advisory.vulnerable}: {advisory.summary}"
+    )
+    metadata = {
+        **evidence(advisory, flow.sink.symbol, "exploitable"),
+        "source": str(flow.source.symbol),
+        "source_label": flow.source.label,
+        "verdict": "hotspot" if hotspot else "vulnerability",
+    }
+    if verdict is not None:
+        metadata["evidence"] = verdict.evidence
+    if flow.through is not None and flow.sink_location is not None:
+        message += f" through {flow.through}"
+        metadata["through"] = flow.through
+        metadata["sink_line"] = str(flow.sink_location.start_line)
+    return Finding(
+        rule_id="exploitable-vulnerability",
+        message=message,
+        severity=Severity.CRITICAL,
+        confidence=Confidence.MEDIUM if hotspot else Confidence.HIGH,
+        span=flow.location,
+        function=function,
+        metadata=metadata,
+    )

coretrace_python/dependency/graph.py

@@ -11,7 +11,7 @@ from __future__ import annotations
 
 import re
 import tomllib
-from collections.abc import Mapping
+from collections.abc import Iterable, Mapping
 from dataclasses import dataclass
 from pathlib import PurePath
 from types import MappingProxyType
@@ -50,6 +50,13 @@ class Version:
         return self.parts + (0,) * (length - len(self.parts))
 
     def satisfies(self, specifier: str) -> bool:
+        """Whether this version is in ``specifier``: comma-separated clauses all hold, and
+        ``||`` separates alternatives, as an advisory over several release series needs
+        (``>=4.2,<4.2.28 || >=5.2,<5.2.11``)."""
+
+        return any(self._satisfies_all(alternative) for alternative in _alternatives(specifier))
+
+    def _satisfies_all(self, specifier: str) -> bool:
         for clause in [c.strip() for c in specifier.split(",") if c.strip()]:
             match = _CLAUSE.match(clause)
             if match is None:
@@ -91,12 +98,17 @@ class Version:
         return True
 
 
+def _alternatives(specifier: str) -> list[str]:
+    return [a for a in specifier.split("||") if a.strip()] or [""]
+
+
 def _lower_bounds(specifier: str) -> list[Version]:
     bounds: list[Version] = []
-    for clause in [c.strip() for c in specifier.split(",") if c.strip()]:
-        match = _CLAUSE.match(clause)
-        if match is not None and match.group(1) in (">=", ">", "~=", "^", "==", "==="):
-            bounds.append(Version.parse(match.group(2)))
+    for alternative in _alternatives(specifier):
+        for clause in [c.strip() for c in alternative.split(",") if c.strip()]:
+            match = _CLAUSE.match(clause)
+            if match is not None and match.group(1) in (">=", ">", "~=", "^", "==", "==="):
+                bounds.append(Version.parse(match.group(2)))
     return bounds
 
 
@@ -130,6 +142,37 @@ class Requirement:
         return any(v.satisfies(self.specifier) and v.satisfies(vulnerable) for v in candidates)
 
 
+@dataclass(frozen=True)
+class Condition:
+    """What must hold for an entry point to reach, or exploit, the affected code: the
+    value of an argument, the loader or algorithm used, the format decoded, the kind of
+    input, a configuration. ``kind`` says whether the engine can check it: an
+    ``argument`` condition names the argument and the values that satisfy it; a
+    ``semantic`` condition cannot be checked yet and is reported as pending review."""
+
+    kind: str
+    text: str
+    argument: str | None = None
+    values: tuple[str, ...] = ()
+
+    @property
+    def checkable(self) -> bool:
+        return self.kind == "argument"
+
+
+@dataclass(frozen=True)
+class AdvisoryEntryPoint:
+    """A public API through which a project reaches an affected symbol, justified by the
+    fixing commit or by a call path, with the conditions under which it is affected."""
+
+    symbol: SymbolId
+    justification: str
+    conditions: tuple[Condition, ...] = ()
+
+
+DIRECT = "affected symbol, changed by the fix"
+
+
 @dataclass(frozen=True)
 class Advisory:
     id: str
@@ -139,10 +182,36 @@ class Advisory:
     severity: Severity
     affected_symbols: tuple[SymbolId, ...] = ()
     aliases: tuple[str, ...] = ()
+    entry_points: tuple[AdvisoryEntryPoint, ...] = ()
+    # Top-level modules the package installs, to tell an imported package from a merely
+    # required one; defaults to the package name (``pyyaml`` installs ``yaml``: say so).
+    modules: tuple[str, ...] = ()
+
+    def __post_init__(self) -> None:
+        if not self.modules:
+            object.__setattr__(self, "modules", (normalize(self.package).replace("-", "_"),))
 
     def affects(self, requirement: Requirement) -> bool:
         return requirement.name == normalize(self.package) and requirement.may_match(self.vulnerable)
 
+    @property
+    def reachable_symbols(self) -> tuple[SymbolId, ...]:
+        """Every symbol a call to which reaches the vulnerability: the entry points and
+        the affected symbols themselves."""
+
+        return (*(e.symbol for e in self.entry_points), *self.affected_symbols)
+
+    def entry_point(self, symbol: SymbolId) -> AdvisoryEntryPoint | None:
+        return next((e for e in self.entry_points if e.symbol == symbol), None)
+
+    def imported_by(self, symbols: Iterable[SymbolId]) -> bool:
+        """Whether any of the ``symbols`` a project imports belongs to this package."""
+
+        prefixes = tuple(f"python.{m}" for m in self.modules)
+        return any(
+            s.canonical_name == p or s.canonical_name.startswith(p + ".") for s in symbols for p in prefixes
+        )
+
 
 class DependencyGraph:
     def __init__(self, requirements: Mapping[str, Requirement] | None = None, errors: tuple[str, ...] = ()) -> None:

coretrace_python/engine.py

@@ -48,7 +48,12 @@ from coretrace_python.dependency import (
     load_policy,
     parse_dependencies,
 )
-from coretrace_python.dependency.correlation import advisory_sinks, affected_symbols, correlate
+from coretrace_python.dependency.correlation import (
+    Affected,
+    advisory_sinks,
+    affected_symbols,
+    correlate,
+)
 from coretrace_python.findings import (
     FINDING_SCHEMA_VERSION,
     Confidence,
@@ -89,6 +94,7 @@ from coretrace_python.plugins import (
     PluginRegistry,
     ProjectContext,
     ProjectPlugin,
+    apply_refinement,
     discover_plugins,
     run_plugins,
 )
@@ -257,7 +263,7 @@ def load_plugins(plugin_roots: Sequence[Path], manager: AnalysisManager) -> Plug
 def plugin_models(plugins: Iterable[Plugin]) -> ModelTable:
     models = SecurityModelRegistry()
     for plugin in plugins:
-        models.register(*plugin.models)
+        models.register(*plugin.models, origin=plugin.name)
     return models.freeze()
 
 
@@ -460,6 +466,9 @@ def analyze_project(
     for plugin in all_plugins:
         if isinstance(plugin, ProjectPlugin):
             findings.extend(plugin.analyze_project(context))
+    for plugin in all_plugins:
+        if isinstance(plugin, ProjectPlugin):
+            findings = list(apply_refinement(plugin, findings, plugin.refine(context, tuple(findings))))
     kept, suppressed = partition(apply_policy(policy, findings), _text_of(sources))
     return ProjectAnalysis(
         graph,
@@ -477,12 +486,13 @@ def analyze_project(
 def _merge_advisories(
     from_plugins: Iterable[Advisory], from_files: Iterable[Advisory]
 ) -> tuple[Advisory, ...]:
-    """One advisory per identifier, package and range; a local file's version wins over
-    a plugin's, since the file is the project's own curated feed."""
+    """One advisory per identifier and package: a later contributor replaces an earlier
+    one, so a curated plugin refines a bundled sample and a local file, the project's
+    own feed, wins over every plugin."""
 
-    merged: dict[tuple[str, str, str], Advisory] = {}
+    merged: dict[tuple[str, str], Advisory] = {}
     for advisory in (*from_plugins, *from_files):
-        merged[(advisory.id, advisory.package, advisory.vulnerable)] = advisory
+        merged[(advisory.id, advisory.package)] = advisory
     return tuple(merged.values())
 
 
@@ -520,7 +530,7 @@ def _analyse_managers(
     managers: Mapping[str, AnalysisManager],
     seed: SummaryIndex,
     plugins: tuple[Plugin, ...],
-    affected: Mapping[SymbolId, Advisory],
+    affected: Affected,
 ) -> dict[str, CachedModule]:
     """Analyse one component: iterate its summaries to a fixpoint over ``seed`` (§21),
     then extract what the rest of the run needs from each module."""
@@ -634,7 +644,7 @@ def _configuration_key(
 
 
 def _analyse_module(
-    manager: AnalysisManager, plugins: tuple[Plugin, ...], affected: Mapping[SymbolId, Advisory]
+    manager: AnalysisManager, plugins: tuple[Plugin, ...], affected: Affected
 ) -> CachedModule:
     """One module's findings, summaries and call sites: what the cache keeps (§11)."""
 

coretrace_python/interprocedural/callgraph.py

@@ -16,7 +16,12 @@ from typing import ClassVar
 from coretrace_python.analysis import Analysis, AnalysisContext, AnyAnalysis
 from coretrace_python.cfg import CFGError
 from coretrace_python.hir import nodes
-from coretrace_python.ir.lowering import LoweringError, analyzable_functions, qualified_name
+from coretrace_python.ir.lowering import (
+    MODULE_BODY,
+    LoweringError,
+    analyzable_functions,
+    qualified_name,
+)
 from coretrace_python.ir.model import (
     Await,
     Call,
@@ -198,7 +203,9 @@ def resolve_targets(
     for block in function.blocks:
         for instruction in block.instructions:
             if isinstance(instruction, MakeFunction):
-                qualified = f"{function.name}.{instruction.name}"
+                # A lambda or def made by the module body is named without a prefix, as
+                # its scope's parent is the module.
+                qualified = instruction.name if function.name == MODULE_BODY else f"{function.name}.{instruction.name}"
                 if qualified in nested:
                     targets[instruction.result] = KnownFunction(qualified)
             elif isinstance(instruction, Global):

coretrace_python/interprocedural/modulegraph.py

@@ -73,7 +73,10 @@ def project_symbol(module_name: str, qualified_name: str) -> SymbolId:
     symbols: invalid characters become underscores."""
 
     module = ".".join(_component(part) for part in module_name.split("."))
-    return SymbolId(f"python.{module}.{qualified_name}")
+    # A synthetic body function is ``<module>`` or ``Cls.<body>``: valid as a name, not
+    # as a symbol component. Nothing calls a body, so its symbol only needs to be one.
+    qualified = ".".join(_component(part) for part in qualified_name.split("."))
+    return SymbolId(f"python.{module}.{qualified}")
 
 
 def _component(part: str) -> str:

coretrace_python/ir/lowering.py

@@ -120,7 +120,19 @@ class _FunctionLowerer:
     def resolve(self, name: str) -> Resolution:
         if name in self.cfg.synthetic_locals:
             return Resolution(ResolutionKind.LOCAL, self.scope.id)
-        return self.scopes.resolve(self.scope.id, name)
+        resolution = self.scopes.resolve(self.scope.id, name)
+        # The module body runs as a script: the variables it assigns are its locals, so
+        # ``x = input(); os.system(x)`` connects in SSA and ``for x in ...`` has a target.
+        # Its functions, classes and imports stay globals, which is how the call graph
+        # and the symbol resolution find them.
+        if (
+            resolution.kind is ResolutionKind.GLOBAL
+            and self.scope.kind is ScopeKind.MODULE
+            and (binding := self.scope.bindings.get(name)) is not None
+            and binding.kind is BindingKind.LOCAL
+        ):
+            return Resolution(ResolutionKind.LOCAL, self.scope.id)
+        return resolution
 
     # ------------------------------------------------------------------ expressions
 
@@ -360,6 +372,9 @@ class _FunctionLowerer:
             # records that the import runs here (§39 rule 3).
             module = "." * node.level + (node.module or "") if isinstance(node, nodes.ImportFrom) else ""
             for alias in node.names:
+                if alias.name == "*":
+                    # ``from m import *`` binds through the scope's wildcards, not a name.
+                    continue
                 bound = alias.as_name or alias.name.partition(".")[0]
                 symbol = self.symbols.resolve(self.scope.id, bound)
                 if symbol is None:
@@ -563,8 +578,9 @@ _FUNCTIONS_CACHE_SIZE = 32
 
 
 def analyzable_functions(module: nodes.Module) -> tuple[nodes.Function, ...]:
-    """Top-level functions, the methods of top-level classes, and the functions and
-    lambdas nested inside them, in source order. Computed once per module: the result is
+    """The module body, top-level functions, top-level classes' bodies and methods, and
+    the functions and lambdas nested inside them, in source order. Computed once per
+    module: the result is
     memoised for the last few modules seen, keyed by identity, so every consumer shares
     one tuple and the synthesized lambda functions it holds."""
 
@@ -581,16 +597,54 @@ def analyzable_functions(module: nodes.Module) -> tuple[nodes.Function, ...]:
 
 def _analyzable_functions(module: nodes.Module) -> tuple[nodes.Function, ...]:
     functions: list[nodes.Function] = []
+    body = module_function(module)
+    if body is not None:
+        _collect(body, functions)
     for statement in module.body:
         if isinstance(statement, nodes.Function):
             _collect(statement, functions)
         elif isinstance(statement, nodes.Class):
+            body = class_body_function(statement)
+            if body is not None:
+                _collect(body, functions)
             for member in statement.body:
                 if isinstance(member, nodes.Function):
                     _collect(member, functions)
     return tuple(functions)
 
 
+MODULE_BODY = "<module>"
+CLASS_BODY = ".<body>"
+
+
+def module_function(module: nodes.Module) -> nodes.Function | None:
+    """The module's statements outside its definitions, as a function named ``<module>``
+    with the module's span, so its names resolve in the module scope; ``None`` when the
+    module only defines things."""
+
+    statements = tuple(s for s in module.body if not isinstance(s, nodes.Function | nodes.Class))
+    if not statements:
+        return None
+    return nodes.Function(MODULE_BODY, (), statements, False, module.span)
+
+
+def class_body_function(cls: nodes.Class) -> nodes.Function | None:
+    """A top-level class's statements outside its methods (``field = Field()``), as a
+    function named ``Cls.<body>`` with the class's span, so its names resolve in the
+    class scope."""
+
+    statements = tuple(s for s in cls.body if not isinstance(s, nodes.Function))
+    if not statements:
+        return None
+    return nodes.Function(f"{cls.name}{CLASS_BODY}", (), statements, False, cls.span)
+
+
+def is_body_function(function: nodes.Function) -> bool:
+    """Whether ``function`` is a synthetic module or class body rather than a definition."""
+
+    return function.name == MODULE_BODY or function.name.endswith(CLASS_BODY)
+
+
 def _collect(function: nodes.Function, into: list[nodes.Function]) -> None:
     into.append(function)
 

coretrace_python/plugins/__init__.py

@@ -7,6 +7,8 @@ from coretrace_python.plugins.api import (
     PluginContext,
     ProjectContext,
     ProjectPlugin,
+    RefinementError,
+    apply_refinement,
     run_plugins,
 )
 from coretrace_python.plugins.detectors import SymbolCallDetector, TaintDetector
@@ -44,11 +46,13 @@ __all__ = [
     "PluginRegistry",
     "ProjectContext",
     "ProjectPlugin",
+    "RefinementError",
     "SecretDetector",
     "SecretPattern",
     "SymbolCallDetector",
     "TaintDetector",
     "VersionRange",
+    "apply_refinement",
     "discover_plugins",
     "literals",
     "load_manifest",

coretrace_python/plugins/api.py

@@ -8,6 +8,7 @@ room for out-of-process isolation later.
 
 from __future__ import annotations
 
+import dataclasses
 from abc import ABC, abstractmethod
 from collections.abc import Iterable, Mapping, Sequence
 from pathlib import Path
@@ -99,6 +100,50 @@ class ProjectPlugin(Plugin):
     def analyze_project(self, ctx: ProjectContext) -> Sequence[Finding]:
         raise NotImplementedError
 
+    def refine(self, ctx: ProjectContext, findings: tuple[Finding, ...]) -> Sequence[Finding]:
+        """Reclassify the findings of the run, once every plugin has reported.
+
+        A refinement returns the same findings in the same order and may change only
+        their severity, their confidence and add metadata: what a finding is, where it
+        is and the evidence behind it are not the refiner's to touch. The engine records
+        who reclassified a finding and what it was before, and rejects anything else."""
+
+        return findings
+
+
+class RefinementError(Exception):
+    """A refinement did more than reclassify a finding."""
+
+
+REFINABLE = ("severity", "confidence")
+
+
+def apply_refinement(plugin: Plugin, original: Sequence[Finding], refined: Sequence[Finding]) -> tuple[Finding, ...]:
+    """The refined findings, checked against the contract of ``ProjectPlugin.refine`` and
+    stamped with a trace of the reclassification."""
+
+    if len(refined) != len(original):
+        raise RefinementError(f"plugin {plugin.name!r} returned {len(refined)} findings for {len(original)}")
+    kept: list[Finding] = []
+    for before, after in zip(original, refined, strict=True):
+        for attribute in ("rule_id", "message", "span", "function"):
+            if getattr(before, attribute) != getattr(after, attribute):
+                raise RefinementError(f"plugin {plugin.name!r} changed the {attribute} of a finding")
+        lost = [k for k, v in before.metadata.items() if after.metadata.get(k) != v]
+        if lost:
+            raise RefinementError(f"plugin {plugin.name!r} changed the evidence {lost} of a finding")
+        changed = [a for a in REFINABLE if getattr(before, a) != getattr(after, a)]
+        if not changed:
+            kept.append(after)
+            continue
+        trace = dict(after.metadata)
+        for attribute in changed:
+            trace.setdefault(f"original_{attribute}", getattr(before, attribute).value)
+        refiners = trace.get("refined_by", "")
+        trace["refined_by"] = f"{refiners},{plugin.name}" if refiners else plugin.name
+        kept.append(dataclasses.replace(after, metadata=trace))
+    return tuple(kept)
+
 
 class PluginContext:
     """What one plugin may see while analysing one module."""
@@ -118,7 +163,8 @@ class PluginContext:
         return self._manager.module
 
     def functions(self) -> tuple[nodes.Function, ...]:
-        """Top-level functions and methods the engine can analyse."""
+        """The functions the engine analyses: the module body (``<module>``), top-level
+        functions, class bodies (``Cls.<body>``) and methods."""
 
         return self._functions
 

coretrace_python/plugins/loader.py

@@ -4,6 +4,7 @@ from __future__ import annotations
 
 import hashlib
 import importlib.util
+import sys
 from dataclasses import dataclass
 from pathlib import Path
 
@@ -63,16 +64,31 @@ def discover_plugins(root: Path, manager: AnalysisManager) -> tuple[LoadedPlugin
 
 
 def _import_entrypoint(directory: Path, manifest: PluginManifest) -> type[Plugin]:
-    module_path = directory / f"{manifest.entrypoint.module}.py"
+    """Import the entrypoint, a module ``<name>.py`` or a package ``<name>/__init__.py``.
+
+    The module name derives from the path, so two plugins may both call their module
+    ``models``. The module is registered in ``sys.modules`` under that name before it
+    runs: a package's relative imports resolve through it, and so does ``dataclasses``
+    when it evaluates postponed annotations."""
+
+    package_path = directory / manifest.entrypoint.module / "__init__.py"
+    is_package = package_path.is_file()
+    module_path = package_path if is_package else directory / f"{manifest.entrypoint.module}.py"
     if not module_path.is_file():
         raise ManifestError(
             f"{directory / MANIFEST_FILENAME}: entrypoint module"
             f" {manifest.entrypoint.module!r} not found"
         )
     unique = hashlib.sha1(str(module_path.resolve()).encode()).hexdigest()[:12]
-    spec = importlib.util.spec_from_file_location(f"coretrace_plugin_{unique}", module_path)
+    name = f"coretrace_plugin_{unique}"
+    spec = importlib.util.spec_from_file_location(
+        name,
+        module_path,
+        submodule_search_locations=[str(module_path.parent)] if is_package else None,
+    )
     assert spec is not None and spec.loader is not None
     module = importlib.util.module_from_spec(spec)
+    sys.modules[name] = module
     spec.loader.exec_module(module)
 
     candidate = getattr(module, manifest.entrypoint.class_name, None)

coretrace_python/semantic/scopes.py

@@ -218,7 +218,9 @@ class _Collector:
             ScopeId(str(module.span.source_id)), ScopeKind.MODULE, "<module>", None, module.span
         )
         self.builders: list[_ScopeBuilder] = [self.module]
-        self.spans: dict[SourceSpan, ScopeId] = {}
+        # The module scope is found by the module's span, as the synthetic ``<module>``
+        # function carries it.
+        self.spans: dict[SourceSpan, ScopeId] = {module.span: self.module.id}
         self.body(module.body, self.module)
 
     def body(self, statements: tuple[nodes.Statement, ...], scope: _ScopeBuilder) -> None:

coretrace_python/taint/engine.py

@@ -38,7 +38,7 @@ from coretrace_python.interprocedural import (
     SummaryTable,
     project_symbol,
 )
-from coretrace_python.ir.lowering import analyzable_functions
+from coretrace_python.ir.lowering import analyzable_functions, is_body_function
 from coretrace_python.ir.model import (
     BasicBlock,
     Branch,
@@ -147,8 +147,10 @@ class _TaintProblem(DataflowProblem[State]):
         project: SummaryIndex | None = None,
         heap: HeapFacts | None = None,
         seeds: Mapping[HeapLocation, Taint] | None = None,
+        module: str = "",
     ) -> None:
         self.name = name
+        self.module = module
         self.function = function
         self.models = models
         self.graph = graph
@@ -294,9 +296,10 @@ class _TaintProblem(DataflowProblem[State]):
                 through = target.symbol.canonical_name.removeprefix("python.")
                 bound = () if project.static else self.receiver(call, project.name)
                 arguments = (*(self.deep(r, state) for r in bound), *arguments)
-                return self.known(
+                result = self.known(
                     project, through, arguments, keywords, everything, call, flows, state, (), bound
                 )
+                return self.declared_clean(target.symbol, result)
             symbol = target.symbol
             if not self.modelled(symbol):
                 # ``get_conn().execute`` derived ``app.database.get_conn.execute``; what
@@ -312,9 +315,10 @@ class _TaintProblem(DataflowProblem[State]):
                 *arguments,
                 *(self.deep(value, state) for value in captured),
             )
-            return self.known(
+            result = self.known(
                 summary, target.name, arguments, keywords, everything, call, flows, state, captured, bound
             )
+            return self.declared_clean(project_symbol(self.module, target.name), result)
         returned = self.returned_symbol(call)
         if returned is not None:
             return self.external(returned, everything, call, state, flows)
@@ -369,6 +373,13 @@ class _TaintProblem(DataflowProblem[State]):
         made = self.defs.get(call.callee)
         return made.captured if isinstance(made, MakeFunction) else ()
 
+    def declared_clean(self, symbol: SymbolId, result: Taint) -> Taint:
+        """A ``Sanitizer`` declared on a project function is the project's own knowledge
+        of what its result carries; it wins over what the summary derived from the body."""
+
+        sanitizer = self.models.sanitizer(symbol)
+        return result if sanitizer is None else result.without(sanitizer.kinds)
+
     def modelled(self, symbol: SymbolId) -> bool:
         return (
             self.models.sink(symbol) is not None
@@ -582,7 +593,12 @@ def local_instances(function: nodes.Function, scopes: ScopeTable, symbols: Symbo
 
 
 def _enclosing(module: nodes.Module, function: nodes.Function) -> nodes.Function | None:
-    """The function whose body defines ``function``, if it is nested."""
+    """The function whose body defines ``function``, if it is nested. A module or class
+    body is nested in nothing, and encloses nothing: a lambda at module level reads
+    globals, not the locals of a function."""
+
+    if is_body_function(function):
+        return None
 
     def search(
         body: tuple[nodes.Statement, ...], parent: nodes.Function | None
@@ -607,6 +623,8 @@ def _enclosing(module: nodes.Module, function: nodes.Function) -> nodes.Function
     # analysable function whose span contains theirs.
     innermost: nodes.Function | None = None
     for candidate in analyzable_functions(module):
+        if is_body_function(candidate):
+            continue
         if candidate.span != function.span and _contains(candidate.span, function.span):
             innermost = candidate
     return innermost
@@ -730,8 +748,9 @@ def propagate_taint(
     project: SummaryIndex | None = None,
     heap: HeapFacts | None = None,
     seeds: Mapping[HeapLocation, Taint] | None = None,
+    module: str = "",
 ) -> TaintFacts:
-    problem = _TaintProblem(name, function, models, graph, summaries, parameters, project, heap, seeds)
+    problem = _TaintProblem(name, function, models, graph, summaries, parameters, project, heap, seeds, module)
     solution = solve(problem, cfg)
     taints: dict[Key, Taint] = {}
     flows: list[TaintFlow] = []
@@ -794,6 +813,7 @@ class TaintAnalysis(FunctionAnalysis[TaintFacts]):
             ctx.get(ProjectSummaries),
             heap,
             seeds,
+            ctx.module.name,
         )
 
 

coretrace_python/taint/models.py

@@ -30,10 +30,14 @@ class TaintKind(Flag):
     ADVISORY = auto()
     DESERIALIZATION = auto()
     REDIRECT = auto()
-    ALL = SQL | COMMAND | HTML | PATH | SSRF | CODE | ADVISORY | DESERIALIZATION | REDIRECT
-    # Outside ALL on purpose: only credential-named parameters carry it, so a database
-    # write reached by ordinary input is not a plaintext credential.
+    NOSQL = auto()
+    ALL = SQL | COMMAND | HTML | PATH | SSRF | CODE | ADVISORY | DESERIALIZATION | REDIRECT | NOSQL
+    # Outside ALL on purpose: only the values a model marks carry them, so a database
+    # write reached by ordinary input is not a plaintext credential, and ordinary input
+    # reaching a logger is neither log forging nor a personal-data leak.
     CREDENTIAL = auto()
+    LOG = auto()
+    PII = auto()
 
 
 class ModelError(Exception):
@@ -69,6 +73,11 @@ class Sink:
                 kinds &= ~restricted
         return kinds
 
+    def merged(self, other: Sink) -> Sink:
+        """This sink with ``other``'s kinds and positions added."""
+
+        return Sink(self.symbol, self.kinds | other.kinds, self.positions + other.positions)
+
 
 @dataclass(frozen=True)
 class Sanitizer:
@@ -251,11 +260,7 @@ class ModelTable:
         merged = {sink.symbol: sink for sink in self.sinks}
         for sink in sinks:
             current = merged.get(sink.symbol)
-            merged[sink.symbol] = (
-                Sink(sink.symbol, current.kinds | sink.kinds, current.positions + sink.positions)
-                if current is not None
-                else sink
-            )
+            merged[sink.symbol] = sink if current is None else current.merged(sink)
         return ModelTable(
             self.sources,
             tuple(merged.values()),
@@ -279,15 +284,31 @@ class SecurityModelRegistry:
 
     def __init__(self) -> None:
         self._models: dict[tuple[type[Model], SymbolId], Model] = {}
+        self._origins: dict[tuple[type[Model], SymbolId], str | None] = {}
+
+    def register(self, *models: Model, origin: str | None = None) -> None:
+        """Add models; ``origin`` names the plugin so a conflict can name both sides.
+
+        Two plugins may describe the same symbol: an identical model is ignored, sinks
+        merge their kinds and positions, any other difference is a conflict."""
 
-    def register(self, *models: Model) -> None:
         for model in models:
             key = (type(model), model.symbol)
-            if key in self._models:
+            current = self._models.get(key)
+            if current is None:
+                self._models[key] = model
+                self._origins[key] = origin
+            elif current == model:
+                continue
+            elif isinstance(model, Sink) and isinstance(current, Sink):
+                self._models[key] = current.merged(model)
+            else:
+                registered = self._origins[key]
+                sides = f" by {registered!r} and {origin!r}" if registered and origin else ""
                 raise ModelError(
-                    f"{type(model).__name__.lower()} model for {model.symbol} is already registered"
+                    f"{type(model).__name__.lower()} model for {model.symbol}"
+                    f" is registered twice{sides} with different values"
                 )
-            self._models[key] = model
 
     def freeze(self) -> ModelTable:
         models = list(self._models.values())

{coretrace_python_analyzer-0.2.0.dist-info → coretrace_python_analyzer-0.4.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: coretrace-python-analyzer
-Version: 0.2.0
+Version: 0.4.0
 Summary: Static security analysis infrastructure for Python code
 Project-URL: Homepage, https://github.com/CoreTrace/coretrace-python-analyzer
 Project-URL: Repository, https://github.com/CoreTrace/coretrace-python-analyzer

{coretrace_python_analyzer-0.2.0.dist-info → coretrace_python_analyzer-0.4.0.dist-info}/RECORD

@@ -1,8 +1,8 @@
-coretrace_python/__init__.py,sha256=Aitn8kEWC3OxAz_1TliVDkeY0-Dz9mZf-S09r7oSD4M,75
+coretrace_python/__init__.py,sha256=uJFWBDpap961PWbZ01zYoAZ0LTF4lnI0UH11pEl6GEw,75
 coretrace_python/__main__.py,sha256=V8DnYtRboISK2VCKm7DGHLREKvqLbqApyWlKBOs26wU,65
-coretrace_python/cache.py,sha256=267JaeUore7nmYwCRQ5dv4VIESyeFkQg4MqLPXOyUcc,11194
+coretrace_python/cache.py,sha256=Aj6o-PvOHoTjLRuD-rJqYZv-fnPnp7NmbNFmfWssOvk,11316
 coretrace_python/cli.py,sha256=ZE6F8wqNcE-ogfldii-UgUq4nOcEMnHuMCzz0l--yuw,9792
-coretrace_python/engine.py,sha256=RDuwxwMOV1pT7fX2T9WU9EfoBn_9dNXOcY-7ztNpb5U,27154
+coretrace_python/engine.py,sha256=FGMR22fXmBnt_iafkM7-xSh9vYhw15OPKGvTTJu-xiQ,27403
 coretrace_python/abstract/__init__.py,sha256=n5FNkV8Z4LmwG0r06KWdLj4N2CPSgAKwY3896tdmRgM,999
 coretrace_python/abstract/constants.py,sha256=z4-e7IzysxzGi58wFFff1MlEoV8l7AZsB9EL-q6b7vY,9071
 coretrace_python/abstract/heap.py,sha256=OaESXFGC0qzyhAr76xrCu4skeDVzZM4wlenQqfMTkdk,9642
@@ -14,11 +14,11 @@ coretrace_python/analysis/provider.py,sha256=Q_OlEcoLzBAsNdAGWijbj_n3E2Ep5UQ4Z8_
 coretrace_python/bundled/dependency/dependency_policy/dependency_policy.py,sha256=_CJYHijv4DTgfdumcCqAVV5_MPWjfZOadxeM5pQdw_k,1845
 coretrace_python/bundled/dependency/dependency_policy/plugin.toml,sha256=4w1TA-UKsa82WTnd1xy4bJuU3_G2RNCAWNICLPcZLMk,210
 coretrace_python/bundled/dependency/reachable_vulnerability/plugin.toml,sha256=LuF9jQqZfplN_GBky69Xjq2pksaX1Fs8PYEir-7-vY8,275
-coretrace_python/bundled/dependency/reachable_vulnerability/reachable_vulnerability.py,sha256=jMNw7-ly4Bhjh3gaUDW7z43HOoQPH9f17M3sZ8HtK2M,2507
+coretrace_python/bundled/dependency/reachable_vulnerability/reachable_vulnerability.py,sha256=nPwOlbebAhMNmk4BHldNe-UMrsK6qUUs1bL4z8fObvY,2186
 coretrace_python/bundled/dependency/sample_advisories/plugin.toml,sha256=cME4pSFzkFsxmIJGGBSrmXqynAd0dg34X-rgEoZ_u6E,184
-coretrace_python/bundled/dependency/sample_advisories/sample_advisories.py,sha256=uViz4fvg2-u7jFKPtPY2G0yPhr_8Ba09exZc-fcZ2w8,3649
+coretrace_python/bundled/dependency/sample_advisories/sample_advisories.py,sha256=jw98GK6hh5RAx05t8QPcUzsFMfGigAL8418vZLprKlc,3710
 coretrace_python/bundled/dependency/vulnerable_dependency/plugin.toml,sha256=FbmiXLEqtPUZEsDc5q_UqCzn6AecL5HCSdGVy7_2dy0,238
-coretrace_python/bundled/dependency/vulnerable_dependency/vulnerable_dependency.py,sha256=Mu4pOhNrfxds-qsFr9_DZOAQHaW2QAKxwelQEpm41vU,1871
+coretrace_python/bundled/dependency/vulnerable_dependency/vulnerable_dependency.py,sha256=ruwruejQ_NqYy7osxfaiPFRlus1DsMEluJ2obhxATkM,2092
 coretrace_python/bundled/models/aiohttp/aiohttp_models.py,sha256=EraiXpZih8yPRk5t0OKe2TMJO9iATv4Kj_lKLp_KpfA,2946
 coretrace_python/bundled/models/aiohttp/plugin.toml,sha256=YvU60RUBexYBtIxbXdmUhO83BoijmOe3MeQKwY8QDaM,220
 coretrace_python/bundled/models/bottle/bottle_models.py,sha256=0yt8-7g-Pxtas3qQcIdORkWLiqJu4O3JzCrSnhzbgHs,1885
@@ -88,10 +88,10 @@ coretrace_python/cfg/model.py,sha256=6EJiXFAGrsMgCdyxMJ6TClY8tQhJF6Hq2bX802Gc0yg
 coretrace_python/dataflow/__init__.py,sha256=N5uY8VTNjEk6-ARCgDkxr6uGqQIz2NbF-U9sC_v_lfA,547
 coretrace_python/dataflow/lattice.py,sha256=HgYGVcKVUlexvEc0yT47aQCudLxU_SWLpHhr17igkiE,1929
 coretrace_python/dataflow/solver.py,sha256=iDsW0wujhM2DXplu2JMKC46BRsroXlNETHPEoikPeG4,3475
-coretrace_python/dependency/__init__.py,sha256=JOa2OupSyMe6COiSF9Cah6kcdqYJewFprWi9-E1Je6Q,983
-coretrace_python/dependency/advisories.py,sha256=BDZatgUvxeW8vOLLnGax49gSPBO3yiRlUHcPpaZKeMc,6333
-coretrace_python/dependency/correlation.py,sha256=psRKsca9W8Mr790VfFHIjGiblE0k4onKIW-Y2nlt8I0,3562
-coretrace_python/dependency/graph.py,sha256=LIH8PdBBzpqNsic8tQHQmO8LuTJXEHSDHDGnW0mKjwc,10812
+coretrace_python/dependency/__init__.py,sha256=sZdigKRbM4NkV0Dr86FDF3rFRQz35pICVX6obgO2Rxo,1065
+coretrace_python/dependency/advisories.py,sha256=RMEQ_9bvZ7OThjBncM5CbKzsmySPvQYuNMZqQVcrVnc,7765
+coretrace_python/dependency/correlation.py,sha256=nyysSoXPz9jg_X8zeweybDpJRXLmj4eH0Z0_WQw5rd0,4916
+coretrace_python/dependency/graph.py,sha256=Z0_u4v0hAYMCAyXEWMh7NwcG2FesIHsXUd3Fl8C1MF8,13617
 coretrace_python/dependency/policy.py,sha256=u6nUw2nX-kTuqmw_vooxN8eXZoC31ZMoMaxC9pCcwec,2317
 coretrace_python/dependency/sbom.py,sha256=h4K3Gb9O_D6uZyfpwpC5rPcNjH_Ib-3uvFxix6OKlfs,2520
 coretrace_python/findings/__init__.py,sha256=gnJI-uB2CkgZ8I5aFYP_N5yZb7FGNIy7LirVDh4NLwo,372
@@ -107,19 +107,19 @@ coretrace_python/hir/__init__.py,sha256=xMpvj-RSp6bd78a_hhkqbe99-snjERkH-_Lv5o9A
 coretrace_python/hir/nodes.py,sha256=4BI0f3UhKbnz9ZIxMoKXM7ujav0BmRpD0OXaoblRxIk,12364
 coretrace_python/hir/visitors.py,sha256=JFnX09hK6trLyRcWgZ5ehOG2ywX3VvkqQ1h82nahYNg,885
 coretrace_python/interprocedural/__init__.py,sha256=57nLUicdsnX0uIub--EUcLt3TRazzZxy2LQ8TRwlOS0,1054
-coretrace_python/interprocedural/callgraph.py,sha256=J6XnAPOO8VL4aJJUmSDvhIITjxIOp2mq5veacvXAuhs,15004
-coretrace_python/interprocedural/modulegraph.py,sha256=0UIKtxxAfTV7WW4B0xcJgVnD-Z6KRS3hpOTMshj1E_U,8595
+coretrace_python/interprocedural/callgraph.py,sha256=5YJ3W5JsKf-uSHkwDvSPBRS1X1ZTyjPaz-wJ8aJV3zE,15232
+coretrace_python/interprocedural/modulegraph.py,sha256=4sB7OKjBYfxtm7aMtHm2jRlqFVUNUsdnLhnv9UZ1BWA,8846
 coretrace_python/interprocedural/summaries.py,sha256=6JFrTaMkG34g_nLhfmckjxKWvexCGvXuXozLliw6xQ8,20427
 coretrace_python/ir/__init__.py,sha256=ShBPYYqoQFePP-mgBjGezQ2acel0-ReOHF9vCC-G_4Q,232
 coretrace_python/ir/defuse.py,sha256=CZEPnlgntRp4MqwR7kLldd2ZlIlBnr-V9VJAxXxwm0c,2616
-coretrace_python/ir/lowering.py,sha256=YFSXKgsjcr1Ul33C8jMM_yxeFpGsAzFCte1mXNIoatw,29112
+coretrace_python/ir/lowering.py,sha256=V7r_4tEOi801NBOsPdG6pwrRHZIeVTahygYENneLQ4U,31428
 coretrace_python/ir/model.py,sha256=i7LvHEnl5pmWYUcSui17ZGS1rdPVavMpnjt7Tog7P4c,11125
 coretrace_python/ir/printer.py,sha256=otBIhZUvB_UfB68gid_FbPcSjBUSmxH3v7vBMZZQVkg,9125
 coretrace_python/ir/ssa.py,sha256=cIYbcv90PI6AOeMrw2ZWp88fy7E2ZO4P3tqjtPHra7g,11116
-coretrace_python/plugins/__init__.py,sha256=Jh5oLVI_Rc7ZzibsMjJzg69LGeNcRRjLcY5XaVOhjgA,1308
-coretrace_python/plugins/api.py,sha256=y1bicTdPypstWs7aJ4JDIOSVKX-MwFq5NSjGntTZhDw,5309
+coretrace_python/plugins/__init__.py,sha256=xRKqkvkvQMmfQACHHoBioYhIyyK4HoMAVogy6EZG8tg,1398
+coretrace_python/plugins/api.py,sha256=Fjjy3FjnkS9OoQ55eLQZ-YJgykd4TgKNAYXySb0uSXY,7588
 coretrace_python/plugins/detectors.py,sha256=ej5Z_MS0CBqrR4b9xycjTVUIo5arpArpdbr7nL732iI,5700
-coretrace_python/plugins/loader.py,sha256=e7S6l3VhMpku0HpnAl5qbBRFiOlsSf66P7low7RsRvU,3174
+coretrace_python/plugins/loader.py,sha256=Use-lHTL4-IJYQBZmODC89zhJbYKGvDSLZHWjZa5NaI,3885
 coretrace_python/plugins/manifest.py,sha256=F24pgQSwApRUL6ZihRSLv9wL_M03A_pZjrj9Zi4Ku3Q,3438
 coretrace_python/plugins/registry.py,sha256=ixKcT2YDky96TWCFckdzKnGRmFn1dbBVMSZLPvdxvY8,1177
 coretrace_python/plugins/secrets.py,sha256=fpCxXpz3u7a-p1mAabC99FK_DpC1RSg62lLPe96pGy8,15162
@@ -131,18 +131,18 @@ coretrace_python/reporters/text.py,sha256=bHsHkMheyL0AB1iWtxBO5H9S14k1AqJvKkNsFr
 coretrace_python/semantic/__init__.py,sha256=_tjT9CgXfPbOMs8EFguhWrLeSmpyrqOHU_OSoQPiWYs,411
 coretrace_python/semantic/identity.py,sha256=uQBdqEXrOtYmGIiR9hZu0Pimv52iW1rOOOvIdG0InNY,1472
 coretrace_python/semantic/imports.py,sha256=389MZs8iTUc3CyUHG0VAgWFsypd7VPFKkLHmFz9L-N0,5673
-coretrace_python/semantic/scopes.py,sha256=wLnXs81gCs9M_HNXp4FZUVAydYWNkdeJFgq6z8atL0k,20095
+coretrace_python/semantic/scopes.py,sha256=zg8ClITSAUbOMvLOV5BsfdG1oC4cd0VweUb9S5Jc4js,20241
 coretrace_python/semantic/symbols.py,sha256=3JptnnX5_KBlSd00L_wcGlYZQdnmBvSBAhfivBF6DLo,3513
 coretrace_python/source/__init__.py,sha256=0Y8fvtbkETnNCJR9Zq7RS5TSgF9c22pz3SSk1KdAXF0,301
 coretrace_python/source/manager.py,sha256=JRmMOcWfS1nocbVrdcvfQTqEfIkmnb5JP857TpGywN4,2736
 coretrace_python/source/model.py,sha256=FZnN5mlir3tzbIpWoxnn6YtRi9UcJ_y0sZM60tKr8U4,1727
 coretrace_python/taint/__init__.py,sha256=D-NH3kx9wKTNeWASewawGAx7ChOkGMGhmjf-E4crHl0,1111
-coretrace_python/taint/engine.py,sha256=QedazdxW-5jwiYbZWFI7AyQycSQWNDVOVbkPIKkI0i8,34667
-coretrace_python/taint/models.py,sha256=s7luO5vMaowxPcWoThkLTEdYuyw0JZZVkaKYW5o_xOI,10930
+coretrace_python/taint/engine.py,sha256=tj28lfqWZSyddXsJ2c0Q7zbVSmk8ceZ-FccZDoBuhd4,35605
+coretrace_python/taint/models.py,sha256=H-Q_nChzwqm-MEGfbfw5jMegpXlIfwUIunFiRXbE90I,12005
 coretrace_python/taint/routes.py,sha256=UAJKXcw_sM9shf58FfDroxVO9bNSm4qrQdZknwUB0lo,6110
-coretrace_python_analyzer-0.2.0.dist-info/METADATA,sha256=Cztxh-bWrr4a_Ttxusa8jsRqA1i5knoRD9gbF_X4jlU,3216
-coretrace_python_analyzer-0.2.0.dist-info/WHEEL,sha256=zOwg4jB6zX2kU910N-cMawjivD6tO8NEWvE12je1bVk,87
-coretrace_python_analyzer-0.2.0.dist-info/entry_points.txt,sha256=wdozemiraOkbt65g_Y_zgspuZpoLxJdaCVMJt1Ft3c0,72
-coretrace_python_analyzer-0.2.0.dist-info/licenses/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358
-coretrace_python_analyzer-0.2.0.dist-info/licenses/NOTICE,sha256=s3VHj5ngV0ozjW_kZJpg_35ne6JwoBK0ysOjbqVtA0w,113
-coretrace_python_analyzer-0.2.0.dist-info/RECORD,,
+coretrace_python_analyzer-0.4.0.dist-info/METADATA,sha256=4CTPKMus5dgilu4I3lpROK-gLTL9HiQC5P75aZu8Kj8,3216
+coretrace_python_analyzer-0.4.0.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
+coretrace_python_analyzer-0.4.0.dist-info/entry_points.txt,sha256=wdozemiraOkbt65g_Y_zgspuZpoLxJdaCVMJt1Ft3c0,72
+coretrace_python_analyzer-0.4.0.dist-info/licenses/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358
+coretrace_python_analyzer-0.4.0.dist-info/licenses/NOTICE,sha256=s3VHj5ngV0ozjW_kZJpg_35ne6JwoBK0ysOjbqVtA0w,113
+coretrace_python_analyzer-0.4.0.dist-info/RECORD,,

{coretrace_python_analyzer-0.2.0.dist-info → coretrace_python_analyzer-0.4.0.dist-info}/WHEEL

@@ -1,4 +1,4 @@
 Wheel-Version: 1.0
-Generator: hatchling 1.32.0
+Generator: hatchling 1.32.4
 Root-Is-Purelib: true
 Tag: py3-none-any